I created an app in facebook and added read_mailbox to the required permissions.
When FB asks me to agree on granting access for the app, it only askes for my public profile and friendlist.
All the other stuff works pretty well and I receive a auth_token as well.